Summary Final Decision Art 60
Complaint
Compliance order
Background information
Date of final decision: 3 December 2019
LSA: LV
CSAs: DE-Berlin, DE-Hesse, DE-Rhineland-Palatinate, DK, FR, IE, IT, PL, NO
Legal Reference: Lawfulness of processing (Article 6), Right to erasure (Article 17), Right to be informed (Article 15)
Decision: Infringement of the GDPR, Order to comply
Key words: Right to erasure, Right to be informed, Blacklisted email
Summary of the Decision
Origin of the case
The complainant alleged that their request for deletion of their personal data had not been complied with.
Findings
After an investigation, the LSA found that after accidentally signing up to the controller’s services, the complainant had contacted the controller to ask for the deletion of two accounts made in his name.
The controller responded the next day that this would not be possible. The controller also blacklisted the complainant’s email address, thereby blocking reception of its emails.
Decision
The LSA found that the controller did not have a legal basis to continue processing and storing the complainant’s personal data on a blacklist. An administrative act was issued by the LSA, with the order for the controller to delete the complainant’s personal data from the blacklist or from any storage site or filling system by 20 December 2019.
In addition, the controller was given an order to assess the degree of risk to the rights and freedoms of natural persons, taking into account the nature, extent, context, purposes and technical and organizational measures taken to protect personal data and prevent their possible unlawful processing was issued, and to provide a mechanism to prevent such situations from happening in the future. The controller was asked to inform the LSA of the execution of the order by 20 December 2019.
—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_lv_2020-01_right_to_erasure_summarypublic.pdf
Please see also EDPB Copyright page